There are ways to protect yourself from your spying TV - The Verge

Not every smart TV is as easily hackable as Gamers Nexus says LG’s are, but they’re all tracking what you watch unless you opt out.

If you buy something from a Verge link, Vox Media may earn a commission. See our ethics statement.

The TV world has been a pot of controversy thanks to a two-hour-and-15-minute video from Gamers Nexus claiming LG TVs are nefariously spying on everything you do. They can record and store audio even when they seem to be off, track everything you watch, and could even be hacked remotely and turned into covert surveillance devices. LG TV owners, and tech enthusiasts in general, are furious, and a hurried response from LG has done little to calm the situation.

Some of the claims in the video may be based on speculation and assumptions, but many of the core concerns are real and pervasive. While LG was the focus of the video, every TV company is tracking what you do, collecting that data, and sharing it with its partners. And we agree to it — even if we don’t realize it.

TV prices have come down significantly over the years, to the point where some companies are selling them at a loss. But they make up that shortfall selling user behavior data they collect from the OS. It’s why Walmart bought Vizio in 2024.

There’s a lot going on in the Gamers Nexus video, but we’ll start with the part pretty much everyone making TVs is doing: tracking what you watch, when you watch, where you watch, and how you watch to sell you things about it all. Automatic content recognition (ACR) systems are built into just about every modern TV and can identify the content playing through built-in streaming apps and over the TV’s ports by grabbing snippets of audio or video, converting them into digital fingerprints, and sending them to a database for identification. It’s what allows a TV to make content recommendations, as well as feed you ads based on your viewing habits. It’s also one way companies like Nielsen can track viewership across platforms and services.

In order for TVs to capture this information, you need to agree to it. One of Gamers Nexus’ complaints in the video is that this consent is often buried in confusing and lengthy agreements that you need to accept in order to use the TV, and that companies often use dark patterns or deceptive designs to get users to agree to things without realizing they didn’t have to. For example, the Gamers Nexus video showed an LG TV displaying six different user agreements, including one consenting to ACR, and automatically putting the cursor on “Select All” when only two agreements are required to continue.

As a TV reviewer, I have to deal with end-user license agreements (EULA) and privacy policies on every product I review. And while it might be a losing battle because of the sheer number of TVs and other smart devices that come through my apartment, I take steps to try and protect my privacy. I have a burner Gmail account that is used solely for signing into apps and the TV’s operating system. Initially, I only accept the legally required documents for the TV to work properly so I can run my picture quality tests — both Calman and test discs. I never agree to automatic content recognition, which is referred to by names including Enhanced Viewing, Smart TV Experience, and Samba Interactive TV.

I also dig through all of the menus, partly to become familiar with all the settings available, but also to make sure any ad or data tracking is toggled off. When I need to test voice control, I’ll then accept the voice recognition agreements before testing functionality. And since this is usually the last thing I do in my test process, this is followed by a factory reset before sending the TV back to the manufacturer. If you’re worried about privacy, don’t use voice control. Or if you do, only use the one on a separate streaming box from a brand you trust.

I recommend the same for everyone with a smart TV. Have a dedicated email for logging in to TVs (and, if possible, your streaming apps) that isn’t connected to your personal email. When setting up the TV, only agree to whatever’s necessary for the TV to run if you want to use its OS. And after setup, go through all the menu options to make sure any ad tracking is off, and read the menu prompts closely, as the wording is sometimes confusing (probably intentionally so). Consumer Reports has a great, although slightly older guide to limiting data collection from the different TV manufacturers.

To take it a step further, turn off Wi-Fi and unplug the Ethernet cable from the TV and essentially use it as a dumb TV (the Vizio Mini LED Quantum I reviewed is the best at this). Then, plug in your third-party streaming device of choice. I use an Apple TV 4K. Not because I don’t think Apple harvests any data, but because it doesn’t use ACR and I trust its security protocols more than I do any of the TV manufacturers or Google.

Apple does still offer content recommendation based on what you watch, download, browse, and subscribe to in the Apple TV app. This can be turned off in settings by going to Apps -> TV -> Use Play History -> Off. For third-party apps, such as Netflix or Disney Plus, Apple gives users the option to “Ask App Not to Track,” which blocks the app’s developer from accessing the system advertising identifier. Keep in mind that every streaming service does track your usage within its own app and tie it to your login; many streaming boxes do too.

A good chunk of the Gamers Nexus video focused on broader security concerns and what appear to be much more egregious privacy violations from LG. That includes recording video and audio from the room even when the TV appeared to be off, sending information about the local network to LG’s servers, and logging background audio captured when using the TV’s mic for voice search and voice control. Gamers Nexus and Level1Techs were even able to exploit security vulnerabilities to take control of the TV, which is how they discovered the above.

None of that is good, obviously. But it is worth noting that the scariest part — recording video (from a webcam they attached) and audio when the TV appeared off — seems to have been possible only because Level1Techs rooted the TV using an exploit that they said requires network access. If you have access to a computer, which is what a smart TV is, and you can root it, you can make it do pretty much whatever you want. If the TV is indeed rootable with only network access, that is a legitimate security problem; it still requires an attacker to get into your private network, but gives them a vulnerable endpoint if they do.

With that root access, Gamers Nexus also discovered that when an LG TV’s mic was activated for voice search, it kept recording for 10 to 15 seconds after it last detected speech. It could also detect the “hi LG” wake word and other speech from farther away than you would expect — after Gamers Nexus enabled the far-field microphone and cranked up the mic sensitivity. Taken in combination, that means that as long as anyone within the (long) earshot of the microphones kept talking after the mic was activated, the TV would capture their conversation too and treat it as part of the voice search. That’s not ideal, but Gamers Nexus and Level1Techs did go out of their way to increase the mic’s pickup range and used the optional voice search wake word, both of which are easy to avoid doing.

Alongside their pretty damning testing, there’s also a lot of “it might” and “we think” and outright speculation in the video, not to mention long-distance conclusion jumping. For example: Gamers Nexus’ Steve Burke says that unplugging your TV’s ethernet cable might not be enough to stop it transmitting data to LG, because it could auto-connect to open neighborhood Wi-Fi broadcasts from Comcast or AT&T customers in order to upload that data. There’s no evidence in the Gamers Nexus video that LG TVs actually attempt to do this — these hotspots require user accounts, for one thing — and Burke doesn’t say that they do, or even could, but the implication is clear. This type of rampant speculation undermines the legitimate vulnerabilities Gamers Nexus highlights.

There’s really no way to completely protect yourself from your TV, streaming device, or streaming services gathering your data, at least right now. There’s so much money being made at the expense of consumers and the data collection is so integrated into how these companies work that the change and regulation needs to come from government policymakers. “We need a comprehensive federal privacy law that covers this sort of data collection and misuse,” said Thorin Klosowski, senior security and privacy activist at the Electronic Frontier Foundation (EFF). “Specifically one that requires opt-in consent, with no deceptive design tricks to get that consent, and a data minimization requirement, which would limit the companies to only using data for what’s needed to provide the service.”

The fact that we, as users of tech products, need to actively protect ourselves from the companies that sell us things is bad. But it’s the unfortunate current reality of living in a tech-filled world and taking advantage of the benefits current technology affords. Beyond disconnecting completely and living in a cabin in the woods with a dumb TV and a collection of Blu-rays, the best we can do is limit as much shared information as possible. If it’s possible to keep it private, we should.